Tag: Malware

Posted on

The Malware that doesn’t take “No” for an answer.

Thursday morning, the day after Christmas 2013 I received a call from someone who needed help. “Fred” callously clicked on an attachment from a phising email purporting from Amazon.com.

After that, he kept seing Windows User Account Control (UAC) asking for confirmation to load some executable file.

Clicking “No” did not really help because UCA kept popping up subsequently.

IMG_0456

I booted Windows 7 into “Safe Mode with Command Prompt” and launched Registry Editor (regedit.exe).

I located load command in the registry.

ComputerHKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindows”

delete the content from the “Load” key.

Posted on

Malware Alert: System Care Antivirus

Yet another Malware sighting, and this one disguised itself as “System Care AntiVirus”. I use both Malwarebytes Anti-Malware and Microsoft Security Essentials to get rid it. Internet Explorer seems to be the entry point of this Malware on this particular computer.

System Care Antivirus

Posted on

Tasteless and Despicable

Let me start by saying that spammers are despicable and tasteless, especially when they’re exploiting a tragedy such as the explosions at the Boston Marathon.

Spammers who want to spread malware are sinking to another low. Numbers of readers told us they’ve been getting spam with subjects contain: “explosion at Boston Marathon”

despicable-spam-boston-marathon-explosion

despicable-spam-boston-marathon-explosion-2

The from addresses are blanked out because it might be used as identifier by the spammers.

One of the addresses has been flagged by Google that it “may harm your computer.”

fake-boston-marathon-explosion-news

Posted on

Scam Alert: movieplayerupdate.com and videoplayerdownload.co

A Mozilla Firefox user reported popup ads from movieplayerupdate.com (movieplayerupdate.com/mtrack/free_download/1/pre/).
Another Mozilla Firefox user also reported the popup ads from movieplayerupdate.com (movieplayerupdate.com/flashplayer/download_free/).

Both links now show 404 not found, but not before we managed to grab a screenshot. It says:

http:// movieplayerupdate.com

WARNING! Your Flash Player may be out of date. Please update to continue

movieplayerupdate_dot_com

The site is also telling user:

Please Install Flash Player Pro to Continue

Remember folks, there is no such thing as “Flash Player Pro”.

The links on both “REMIND ME LATER” and “INSTALL” point to: mtrack10.com/base2.php

By clicking either button, an executable file will be downloaded.

movieplayerupdate_dot_com-scam

A user sent us a note that similar popups from videoplayerdownload.co were found (videoplayerdownload.co/free-download/mt/1/pre/).

videoplayerdownload_dot_co-scam

The “Install Now” link also points to mtrack10.com/base2.php

videoplayerdownload_dot_co

It seems that both movieplayerupdate.com (whois info) and videoplayerdownload.co (whois info) are registered by the same individual through GoDaddy on the same day (Feb 20, 2013).

The domain mtrack10.com (whois info) is also registered through GoDaddy one week earlier (Feb 14, 2013).

By clicking the “Install Now” button, an executable file will be downloaded.

——-

It is pretty obvious the individuals behind the domain names mentioned above are unscrupulous. Do not blindly download some programs just because a popup told you so.

To update Flash Player, download it direct from Adobe.

http://www.adobe.com/products/flashplayer/distribution3.html

Posted on

Reporting malicious links to bitly

Recent round of spams propagated using hacked Twitter accounts and bitly URL shortener became the topic of discussion. Just a few days ago Twitter account of Greg Hetson (Bad Religion, Circle Jerks) was hacked and a link using bitly URL shortener to a spam site was posted.

If you encountered any malicious or spam using bit.ly, please report it to bitly immediately.

You can report spam links to support@bitly.com to be blocked. Include the word ‘spam’ in the message and include the link and information about how you received it.

From time to time you’d see that bitly would warn visitors off the malicious URL they about to visit.

bitly-warning